Digital strategic autonomy in practice: lessons from the National Cryptography Strategy
Everyone is talking about digital strategic autonomy. And while talking may not sound particularly action-oriented, it is exactly where it all begins: with a conversation. And for good reasons. If governments and businesses are to work together to ensure that the Netherlands is not dependent on foreign parties for critical digital services, they first need to share their needs, concerns and expectations. But how do you organise and facilitate such a process? How do you keep everyone actively involved and engaged? There are valuable lessons to be learned from the ecosystem orchestration project for the National Cryptography Strategy, a programme in which TNO Vector is involved as the orchestrator.
One way to achieve strategic autonomy is through very close cooperation between public and private parties. But what exactly should that cooperation look like? What works, and what doesn’t? That’s something you discover by doing. ‘This project is an example of how digital strategic autonomy is being put into practice, with all the complexity that it entails,’ says Nick Oostervink, project leader and Ecosystem Orchestrator at TNO Vector.
Separate interests
That complexity calls for a different approach. Sitting on opposite sides of the negotiating table, for example, can be counterproductive, as the focus quickly shifts to individual interests. The Dutch government is looking for security of supply and sufficient control to guarantee certain capabilities and capacity. The industry, meanwhile, wants clarity about long-term public demand so that they can align their investments and forecasts accordingly. Both sides are looking for certainty.
Breaking established patterns
Negotiating individual contracts and relying on conventional market mechanisms is therefore not the way forward. In fact, this traditional approach all too often turns out to be a dead end when the goal is strategic autonomy. The parties involved first need to break established patterns. And that starts with building trust between public and private parties for example by having individual interviews and broader collective workshops to better understand each other’s perspectives and interests. The initial exploratory phase is about having an open conversation, without participants immediately worrying about how everything will eventually be set out in contracts. That comes later. You can write down in a contract that you will collaborate, but that doesn’t actually make it happen.
‘The original request was primarily about exploring new forms of contracts for Dutch cryptography companies.’
Gijs van Houwelingen, Senior researcher collaborative business models at TNO Vector
Looking beyond the legal aspects
Even so, drawing up a contract is often the first instinct. That was also the case when, around two and a half years ago, TNO Vector was asked by a partnership involving CIO Rijk at the Ministry of the Interior and Kingdom Relations, the AIVD and the Ministry of Defence to help shape the National Crypto(graphy) Strategy. ‘The original request focused mainly on exploring new contractual arrangements for Dutch cryptography companies,’ Gijs van Houwelingen recalls. As an expert in Collaborative Business Modelling, however, he soon began looking beyond the legal aspects.
‘Contracts are necessary to formalise agreements properly. But a great deal needs to happen before you get to that point. The most important thing is to ensure that the Netherlands has digital strategic autonomy in the field of cryptography. And that requires robust cooperation between many different parties.’
Protecting state secrets
For context, the programme in which TNO Vector is involved focuses specifically on the high-assurance cryptography industry. A select group of trusted companies supplies the Dutch state with cryptographic products and services. These companies help to safeguard that confidential government information (i.e. state secrets) can be stored and communicated in encrypted form, preventing it from falling into the wrong hands. What these companies develop and produce plays a crucial role in protecting Dutch state secrets – the ‘crown jewels’. In this field, ensuring strategic autonomy in terms of suppliers, products and services is therefore especially important.
The Dutch cryptography market as a model
Although the cryptography sector is relatively unique, it provides a valuable model for other sectors. There are many other vital public and private organisations that depend on a small number of specialist suppliers for critical knowledge, technology or capacity. This was also highlighted in the advisory report that TNO Vector presented to the Dutch House of Representatives last summer.
So let’s take a closer look.
‘We had already put some structures in place to bring together the needs of the different departments into a single agenda. That proved to be a bigger challenge than expected.’
Tony van der Togt, Team Lead at CIO Rijk
Make mutual dependencies explicit
‘We certainly weren’t starting from scratch,’ emphasises Tony van der Togt, team lead at CIO Rijk. ‘We had already established structures to bring together the requirements of different government departments into a single agenda. That proved more challenging than expected. We found that the requirements and development environments of the Ministry of Defence appeared to differ from those of the AIVD.’
‘It is also important to realise that the industry can only make targeted investments and build capacity if there is sufficient understanding of what customers, mainly public-sector organisations, and suppliers need from one another,’ Van Houwelingen adds. ‘The key lesson is that you first need to make mutual dependencies explicit. That means not only identifying the critical dependencies, but also deliberately structuring and managing them.’
More than abstract promises
Strategic autonomy requires organisations to approach information, investment, risk and mutual dependencies differently. They will not automatically commit to a new model of cooperation. More is needed than just abstract promises. Businesses need to understand how a different way of working together fits their business model, what new business models it could enable and what the business case is for them.
Oostervink recognised this during the first meetings between the private and public parties expected to form a thriving cryptography ecosystem.
‘At first, participants were somewhat hesitant, which was understandable. There were no firm guarantees. And creating a new model of cooperation for the cryptography industry requires more than abstract promises about strategic autonomy, security of supply, innovation and growth opportunities.’
Growing political attention
Meanwhile, there have been significant impactful geopolitical developments. Since the programme was launched around two years ago, digital strategic autonomy has received increasing political attention, and with it, growing interest in the implementation of the National Cryptography Strategy. ‘My colleagues see this too, in the number of questions being asked in Parliament about what is needed to achieve digital autonomy,’ says Van der Togt. ‘In addition to the commercial opportunities this creates for businesses, I can see that the private-sector parties in our ecosystem genuinely want to contribute to that digital sovereignty.’
The challenge of implementation
In practice, this also raises legal questions. What are the advantages of being able to use the Defence and Security Procurement Act, which applies to more organisations than the Ministry of Defence alone? What benefits do businesses gain from the harmonisation and standardisation introduced across central government through the General Security Requirements for Government Contracts (ABRO)? And to what extent can parties coordinate with each other regarding developments that are critical to national security? ‘Political attention helps,’ says Van der Togt. ‘Take, for example, the motion submitted by Ceder and others in the Dutch House of Representatives concerning unwanted knowledge transfer and risks to national security*. ‘The State Advocate has also provided greater clarity on the legal scope for action where national security is concerned and issued a separate reflection on the legal reality of the National Cryptography Strategy. One important point is that national security is a broader concept than the procurement of military equipment alone, which creates more possibilities.’
With so many factors at play, it is important to develop a shared vision and strategy that gives both private and public parties an opportunity to contribute. ‘But a strategy alone does not, of course, generate investment, capacity, security of supply or genuinely effective cooperation,’ Van Houwelingen emphasises. ‘Strategic autonomy only becomes a reality when parties translate their mutual dependencies into concrete governance, agreements, investments and joint action.’
* Dutch House of Representatives, parliamentary year 2024–2025, 36 332, no. 40:
‘...considering that it is of the utmost importance to remain alert to unwanted knowledge transfer and risks to national security, including in the context of migration policy; requests the government to stipulate in the relevant labour legislation and regulations that work activities related to the exercise of official authority or the safeguarding of the general interests of the State may only be carried out by Dutch nationals or Union citizens...’
‘That means you sometimes have to adapt the process. We do that regularly too.’
Nick Oostervink, project leader and Ecosystem Orchestrator at TNO Vector
Not a step-by-step plan, but an iterative process
It is important to recognise that public-private partnerships of this kind often involve a careful balancing act. Developing a model together, and doing so properly, takes time. This creates a risk that participants may feel insufficient progress is being made. It is also challenging to balance the interests of industry and government. ‘That means that you sometimes have to adjust the process,’ Oostervink explains. ‘We do that regularly. Last winter, for example, we planned an extensive workshop, but instead turned it into a session in which participating organisations were given the opportunity to share their concerns.’
Van Houwelingen adds: ‘Everything that emerged that afternoon was enormously helpful in developing a cooperation model that works for all the participants. It clearly demonstrated once again that you cannot define a fixed step-by-step plan for these types of partnerships in advance. It has to be an iterative process.’
Sustaining the positive momentum
What does the situation look like today? ‘There really is a different dynamic now. Participants are coming forward with their own ideas, often asking to develop them together. So the informal cooperation is now well established. Our next challenge is to sustain that positive momentum. The success of the ecosystem should not depend too heavily on individual people, temporary urgency or goodwill.’ ‘It’s clear that the flywheel really has been set in motion,’ Oostervink concludes. ‘Industry partners taking the initiative themselves is exactly what we set out to achieve at the start.’
Driving innovation
Van der Togt also sees the ecosystem entering a new phase.
‘We are now in a strong position to jointly develop cryptographic solutions that meet the very highest security standards and contribute to the Netherlands’ digital sovereignty. At the same time, we are focusing on the next step: using the ecosystem to develop new cryptographic products. In other words, innovation. Continued development of the cryptography industry is important, because the need for digital security will only continue to grow.’
All three also emphasise that, ultimately, a growing market is an important safeguard for strategic autonomy. Businesses need prospects for growth if they are to continue investing and, in doing so, contribute to the Netherlands’ digital strategic autonomy.
Why use an ecosystem orchestrator?
Orchestrating ecosystems, innovation and transformation programmes is a role that TNO Vector regularly takes on. Within ecosystems and coalitions, the individual parties are often not responsible for maintaining coherence between public-sector demand, industrial investment, available capacity, legal possibilities and knowledge development. That is why an additional, external, party is needed that can help design and develop the ecosystem as a whole, and subsequently help to operationalise and implement the plans that emerge from it.
Looking to build an ecosystem that turns strategic autonomy into action?
At TNO Vector, we help governments and businesses develop effective models for cooperation. We do this not only as an adviser, but above all by working with the parties involved to design, test and put the necessary collaboration into practice.
Four lessons for building a collaborative ecosystem that contributes to strategic autonomy
Lesson 1: Make mutual dependencies explicit
Start by understanding what public-sector organisations and suppliers need from one another. This includes visibility of future demand, capacity, information, investment, knowledge and commitment. Doing so also makes the mutual dependencies clear. Critical dependencies can then be deliberately structured and managed.
Lesson 2: Build trust and commitment gradually and reciprocally
Do not ask organisations for complete openness or a long-term commitment from the outset. Instead, take one step at a time, with public and private parties both contributing something and receiving something in return. Signed letters of intent, for example, are important, but real trust is built through acting together.
Lesson 3: Design the partnership, not just the contract
Contracts are necessary to formalise agreements. But first there needs to be clarity about the public outcome the parties are seeking to achieve, the capabilities required to deliver it, which parties can provide those capabilities, the risks they will bear, and the long-term prospects the partnership offers to everyone involved.
Lesson 4: Organise for the ecosystem as a whole, not just individual transactions
Bilateral contracts can organise the delivery of products and services, but they do not automatically lead to collective demand aggregation, capacity building, knowledge retention and joint innovation. It is therefore important to have a party that safeguards the coherence between the different participants and their agreements.
